Missing Security Headers (ARCH7141)

Key php.security.missing-security-headers · Severity info · Category security · CWE CWE-693

Two shapes, both file-scoped: a kernel (Kernel extends HttpKernel) whose global $middleware stack names no headers middleware, and a script that sends Content-Type: text/html but never X-Content-Type-Options, Content-Security-Policy or Strict-Transport-Security. Reported as info: a reverse proxy may add them.

Incorrect

class Kernel extends HttpKernel
{
    protected $middleware = [
        \App\Http\Middleware\TrustProxies::class,
        \Illuminate\Http\Middleware\HandleCors::class,
    ];
}

Correct

class Kernel extends HttpKernel
{
    protected $middleware = [
        \App\Http\Middleware\TrustProxies::class,
        \Illuminate\Http\Middleware\HandleCors::class,
        \App\Http\Middleware\SecurityHeaders::class,
    ];
}

Fix

Register a middleware that sets Strict-Transport-Security, Content-Security-Policy and X-Content-Type-Options: nosniff on every response; in plain PHP send them with header() before the body.